MALICIOUS — eb6612_6fea4f336c444179bf97dd8ad3c7ea3b.pdf

MALICIOUS — eb6612_6fea4f336c444179bf97dd8ad3c7ea3b.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: f78c88e00935750d36bbd32aec6d31164f56c83ed99cc167ceb8b87bc38f9139
• SHA-1: df184d598abab6efce40165b38960bbf50f704c5
• MD5: 2f788d3084668a5052524b59ef3f1d79
• ssdeep: 768:RgGzpDuJzkkt6BWq5/TIWt3nJ6OAqlz/S1A8g9oGl1Jr4wkO7qTruwL3:iGF6Jtet3nJ68DmAR9rrr4wwuwL3
• TLSH: T1AC319EF3515BDD8C3B86CF035AF62018A046DA8C3172A96459D877BCC9BC6BDBE10960
• Submitted as: eb6612_6fea4f336c444179bf97dd8ad3c7ea3b.pdf
• File type: pdf · Size: 42692 bytes
• Verdict: malicious (78/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Emsisoft (Emergency Kit): PDF.Spam.Heur.1

Why this verdict

The malicious score of 78/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged PDF.Spam.Heur.1 (rule PDF.Spam.Heur.1) - engine signal, weight 0.55, confidence 0.85
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://ttraff.club/wix?keyword=22.2+hardship+and+suffering+during+the+depression, https://00f72ef0-907d-4a69-95d0-2f175d0c377e.filesusr.com/ugd/a91264_14cf0d1e2f5640c1b669b4658cdd52f7.pdf?index=true, https://879e9e14-0bef-414b-bacb-85c6f803a38f.filesusr.com/ugd/64e449_ce2e6a0230ba4504adffed29eb914f31.pdf?index=true - static signal, weight 0.35, confidence 0.60
• Document active content: uri-action - static signal, weight 0.30, confidence 0.60
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://ttraff.club/wix?keyword=22.2+hardship+and+suffering+during+the+depression
• https://00f72ef0-907d-4a69-95d0-2f175d0c377e.filesusr.com/ugd/a91264_14cf0d1e2f5640c1b669b4658cdd52f7.pdf?index=true
• https://879e9e14-0bef-414b-bacb-85c6f803a38f.filesusr.com/ugd/64e449_ce2e6a0230ba4504adffed29eb914f31.pdf?index=true
• https://68ecbfc1-90bc-4657-85f0-0f61d171602d.filesusr.com/ugd/7a13df_9f63d18d8da54774936c74b552001aed.pdf?index=true
• https://cdn.shopify.com/s/files/1/0469/0545/8848/files/79483749667.pdf
• https://cdn.shopify.com/s/files/1/0438/3644/0733/files/apc_back_ups_rs_700_manual.pdf
• https://cdn.shopify.com/s/files/1/0433/2532/5467/files/millennials_and_technology.pdf
• https://cdn.shopify.com/s/files/1/0428/3544/3871/files/windows_10_boot_camp_software.pdf
• https://4af0a01b-7cbc-4e2e-856e-cbe8ecd02381.filesusr.com/ugd/18f527_3d02f6ef78ae46ad9000f6d857408126.pdf?index=true
• https://19867a25-dc77-425f-97a9-ab14bda4a674.filesusr.com/ugd/9df9d6_d200703251a848a6b97a32655d8de01f.pdf?index=true
• https://cdn.shopify.com/s/files/1/0433/7437/9164/files/apologia_de_socrates_platn.pdf
• https://cdn.shopify.com/s/files/1/0429/9368/0547/files/computer_full_form_all.pdf
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://purl.org/dc/elements/1.1/
• http://ns.adobe.com/pdf/1.3/
• http://ns.adobe.com/xap/1.0/
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/rights/

Embedded domains

• ttraff.club
• 00f72ef0-907d-4a69-95d0-2f175d0c377e.filesusr.com
• 879e9e14-0bef-414b-bacb-85c6f803a38f.filesusr.com
• 68ecbfc1-90bc-4657-85f0-0f61d171602d.filesusr.com
• cdn.shopify.com
• 4af0a01b-7cbc-4e2e-856e-cbe8ecd02381.filesusr.com
• 19867a25-dc77-425f-97a9-ab14bda4a674.filesusr.com
• www.w3.org
• purl.org
• ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report